Dealing with the European Union’s tough new data protection law General Data Protection Regulation (GDPR) feels like moving house and confronting the piles of boxes in the attic. They’re full of stuff you haven’t touched in years. You know you have to clear them out, but you also know they contain a mixture of junk and important stuff. You’re going to have to read every last scrap of paper and do a mega sort-out.
The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.
The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.
Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.
GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.
On top of the day job, dealing with the General Data Protection Regulation (GDPR) is a massive piece of work. Ahead of the compliance deadline on 25 May our team at the School for Social Entrepreneurs (SSE) has had to sort through 21 years of personal data about the social entrepreneurs and charity leaders we support across an international network of 11 schools. That includes email addresses, marketing preferences, phone numbers, financial information about other organisations, sensitive data – the works.
SSE was founded in 1997 and, although our customer relationship management system has been updated since then, there are still records lurking in a plethora of places – there are probably even Filofaxes and Rolodexes to go through. A digital audit revealed we had data stored on platforms such as MailChimp, Eventbrite and Paperless Post, and staff were stashing documents stuffed with data on their desktops for certain projects.
Discussions about how to tackle GDPR started in February 2017 after the organisation signed five-year funding agreements with Lloyds and the Big Lottery Fund, but the bulk of the work is happening now. The confusing terminology has made it a daunting task. I have read endless articles on GDPR that have succeeded only in confusing me more. One catchy phrase that often pops up is having a “valid lawful basis in order to process personal data”. A lot hinges on this, since processing someone’s data is different from being allowed to contact them. The best free guide I’ve found is Charity Finance Group’s GDPR: a guide for charities. It is comprehensive and comprehensible, and encourages you to look at the processes of the whole organisation through the lens of GDPR, not just fundraising and marketing.
In the end, I found it helpful to pay for some support for the team. Two members paid £49 to attend a workshop with solicitors Russell-Cooke, which was helpful. I also hired a freelance GDPR consultant for some initial guidance and to ensure we were on track, and spoke to the law firm Linklaters, with whom we have a pro bono relationship. It helped us update contracts and rewrite our data protection policy. Trustlaw can also be helpful for charities and social enterprises looking for pro bono support.
After developing a plan, my team needed to share it with the wider organisation. GDPR involves far more people than you might think, and everyone needs to be briefed on how to handle personal data.
This has been a complex but valuable process. As an organisation, we are now much more confident in the completeness of our data. Our processes have been streamlined and staff now understand the permission needed when we contact people. We have a greater understanding of how to protect sensitive data about the people we support, and how we can use that to measure our impact.
Much like a spring clean, getting to grips with GDPR is arduous and time consuming. But you’ll feel much better once it’s done.
Philippa Frankl is the director of programmes and learning at the School for Social Entrepreneurs
Sign up now for our free, monthly Voluntary Sector newsletter, and share your view with us via @Gdnvoluntary
Looking for a role in the not-for-profit sector, or need to recruit staff? Take a look at Guardian Jobs
